CVE-2026-48049: 
JavaScript vulnerability analysis and mitigation

CVE-2026-48049 is a path traversal vulnerability (CWE-22) in @hapi/inert, the static file and directory handler plugin for hapi.js. It affects versions 4.0.0 through 7.1.0 and allows an unauthenticated remote attacker to read files outside the intended served directory by exploiting a flawed confinement check. The vulnerability was discovered by researcher imssm99, published on May 20, 2026, and patched in version 7.1.1. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, inert Security Advisory).

The root cause is an improper string-prefix comparison in lib/file.js used to enforce the confine option, which is meant to restrict file serving to a designated directory (CWE-22). The check used path.lastIndexOf(confineDir, 0) !== 0, which passes for any path whose absolute string begins with the confine directory string — including sibling directories that share a name prefix (e.g., /app/static-secret passes the check for a confine directory of /app/static). An attacker can exploit this by sending a URL-encoded path traversal request such as /..%2fstatic-secret/secret.txt, which resolves to the sibling directory and bypasses the confinement check. The fix in commit bcceb76 replaces the raw prefix test with a check that requires the resolved path to equal confineDir exactly or start with confineDir + Path.sep, ensuring directory boundary integrity (inert Security Advisory, Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files within sibling directories of the configured static file directory, provided those files are readable by the server process. The impact is limited to confidentiality — there is no integrity or availability impact. Exploitability is conditional: only applications where a sibling directory exists whose name shares a string prefix with the served directory are vulnerable; applications without such a sibling are unaffected (Github Advisory).

1. Reconnaissance: Identify hapi.js applications using @hapi/inert versions 4.0.0–7.1.0 for static file serving. This can be done via HTTP response headers, JavaScript package manifests, or open-source intelligence.
2. Identify sibling directories: Determine or guess the name of the directory being served (e.g., /app/static) and enumerate potential sibling directories that share a name prefix (e.g., /app/static-secret, /app/static-config).
3. Craft traversal request: Construct a URL-encoded path traversal request targeting the sibling directory, such as GET /..%2fstatic-secret/secret.txt HTTP/1.1. The %2f encoding of the forward slash is used to bypass naive URL parsing.
4. Read files: If the sibling directory exists and the file is readable by the server process, the server returns the file contents directly, bypassing the confine restriction (inert Security Advisory, Fix Commit).

• Network: HTTP GET requests containing URL-encoded path traversal sequences (e.g., ..%2f, %2e%2e%2f) in the request path targeting static file endpoints.
• Logs: Web server access logs showing requests with patterns like /..%2f<sibling-directory-name>/ returning HTTP 200 responses instead of 403; repeated requests probing different sibling directory names suggesting enumeration.
• Process: Unexpected file reads by the Node.js/hapi.js server process from directories outside the configured static file path, observable via file access auditing (e.g., auditd on Linux).

Upgrade @hapi/inert to version 7.1.1, which fixes the confinement check by requiring the resolved path to equal the confine directory or start with confineDir + Path.sep (inert Release v7.1.1). For users unable to upgrade immediately, the official workaround is to ensure the served directory has no sibling directory whose name begins with the same string — for example, rename static-secret/ to secret/ or relocate it to a different parent directory (Github Advisory). Upgrading to 7.1.1 is the recommended and definitive remediation.